Query data in Azure Monitor using Azure Data Explorer (Preview)

The Azure Data Explorer proxy cluster (ADX Proxy) is an entity that enables you to perform cross product queries between Azure Data Explorer, Application Insights (AI), and Log Analytics (LA) in the Azure Monitor service. You can map Azure Monitor Log Analytics workspaces or Application Insights apps as proxy clusters. You can then query the proxy cluster using Azure Data Explorer tools and refer to it in a cross cluster query. The article shows how to connect to a proxy cluster, add a proxy cluster to Azure Data Explorer Web UI, and run queries against your AI apps or LA workspaces from Azure Data Explorer.

The Azure Data Explorer proxy flow:

ADX proxy flow



The ADX Proxy is in preview mode. Connect to the proxy to enable the ADX proxy feature for your clusters. Contact the ADXProxy team with any questions.

Connect to the proxy

  1. Verify your Azure Data Explorer native cluster (such as help cluster) appears on the left menu before you connect to your Log Analytics or Application Insights cluster.

    ADX native cluster

  2. In the Azure Data Explorer UI (https://dataexplorer.azure.com/clusters), select Add Cluster.

  3. In the Add Cluster window, add the URL of the LA or AI cluster.

    • For LA: https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>

    • For AI: https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>

    • Select Add.

    Add cluster


    If you add a connection to more than one proxy cluster, give each a different name. Otherwise they'll all have the same name in the left pane.

  4. After the connection is established, your LA or AI cluster will appear in the left pane with your native ADX cluster.

    Log Analytics and Azure Data Explorer clusters


The number of Azure Monitor workspaces that can be mapped is limited to 100.

Run queries

You can run the queries using client tools that support Kusto queries, such as: Kusto Explorer, ADX Web UI, Jupyter Kqlmagic, Flow, PowerQuery, PowerShell, Jarvis, Lens, REST API.


The ADX Proxy feature is used for data retrieval only. For more information, see Function supportability.


  • Database name should have the same name as the resource specified in the proxy cluster. Names are case sensitive.
  • In cross cluster queries, make sure that the naming of Application Insights apps and Log Analytics workspaces is correct.
  • If names contain special characters, they're replaced by URL encoding in the proxy cluster name.
  • If names include characters that don't meet KQL identifier name rules, they are replaced by the dash - character.

Direct query from your LA or AI ADX Proxy cluster

Run queries on your LA or AI cluster. Verify that your cluster is selected in the left pane.

Perf | take 10 // Demonstrate query through the proxy on the LA workspace

Query LA workspace

Cross query of your LA or AI ADX Proxy cluster and the ADX native cluster

When you run cross cluster queries from the proxy, verify your ADX native cluster is selected in the left pane. The following examples demonstrate combining ADX cluster tables (using union) with LA workspace.

union StormEvents, cluster('https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>').database('<workspace-name>').Perf
| take 10
let CL1 = 'https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>';
union <ADX table>, cluster(CL1).database(<workspace-name>).<table name>

Cross query from the Azure Data Explorer proxy

Using the join operator, instead of union, may require a hint to run it on an Azure Data Explorer native cluster (and not on the proxy).

Join data from an ADX cluster in one tenant with an Azure Monitor resource in another

Cross-tenant queries aren't supported by ADX Proxy. You are signed in to a single tenant for running the query spanning both resources.

If the Azure Data Explorer resource is in Tenant 'A' and LA workspace is in Tenant 'B' use one of the following two methods:

  1. Azure Data Explorer allows you to add roles for principals in different tenants. Add your user ID in Tenant 'B' as an authorized user on the Azure Data Explorer cluster. Validate the 'TrustedExternalTenant' property on the Azure Data Explorer cluster contains Tenant 'B'. Run the cross-query fully in Tenant 'B'.

  2. Use Lighthouse to project the Azure Monitor resource into Tenant 'A'.

Connect to Azure Data Explorer clusters from different tenants

Kusto Explorer automatically signs you into the tenant to which the user account originally belongs. To access resources in other tenants with the same user account, the tenantId has to be explicitly specified in the connection string: Data Source=https://ade.applicationinsights.io/subscriptions/SubscriptionId/resourcegroups/ResourceGroupName;Initial Catalog=NetDefaultDB;AAD Federated Security=True;Authority ID=TenantId

Function supportability

The Azure Data Explorer proxy cluster supports functions for both Application Insights and Log Analytics. This capability enables cross-cluster queries to reference an Azure Monitor tabular function directly. The following commands are supported by the proxy:

  • .show functions
  • .show function {FunctionName}
  • .show database {DatabaseName} schema as json

The following image depicts an example of querying a tabular function from the Azure Data Explorer Web UI. To use the function, run the name in the Query window.

Query a tabular function from Azure Data Explorer Web UI

Additional syntax examples

The following syntax options are available when calling the Application Insights (AI) or Log Analytics (LA) clusters:

Syntax Description Application Insights Log Analytics
Database within a cluster that contains only the defined resource in this subscription (recommended for cross cluster queries) cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>').database('<ai-app-name>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>').database('<workspace-name>)
Cluster that contains all apps/workspaces in this subscription cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>)
Cluster that contains all apps/workspaces in the subscription and are members of this resource group cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>)
Cluster that contains only the defined resource in this subscription cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>)

Next steps

Write queries